Description
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
References (8)
Core 8
Core References
Vendor Advisory x_refsource_confirm
https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p
Patch x_refsource_misc
https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
Release Notes x_refsource_misc
https://github.com/pomerium/pomerium/releases/tag/v0.17.4
Release Notes x_refsource_misc
https://github.com/pomerium/pomerium/releases/tag/v0.18.1
Release Notes x_refsource_misc
https://github.com/pomerium/pomerium/releases/tag/v0.19.2
Release Notes x_refsource_misc
https://github.com/pomerium/pomerium/releases/tag/v0.20.1
Release Notes x_refsource_misc
https://github.com/pomerium/pomerium/releases/tag/v0.21.4
Release Notes x_refsource_misc
https://github.com/pomerium/pomerium/releases/tag/v0.22.2
Scores
CVSS v3
10.0
EPSS
0.0026
EPSS Percentile
49.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-285
Status
published
Products (4)
pomerium/pomerium
0.18.0
pomerium/pomerium
0.20.0
pomerium/pomerium
< 0.17.4
pomerium/pomerium
0.22.0 - 0.22.2Go
Published
May 30, 2023
Tracked Since
Feb 18, 2026